In May this year a member of the European Parliament asked the following:

Subject: Non-evaluation of FATCA agreements by Member States and protection of fundamental rights of EU citizens

On 13 April 2021, the European Data Protection Board (EDPB) invited Member States to re-evaluate their international agreements involving transfers of personal data, in particular agreements struck with the United States under the Foreign Account Tax Compliance Act (FATCA), in order to make these agreements compliant with the General Data Protection Regulation (GDPR). Four years later, and not a single Member State has published the required evaluation. This inaction constitutes a blatant violation of the obligation of responsibility laid down in Article 24 of the GDPR. During this time, the data of thousands of EU citizens continues to be passed on to the Internal Revenue Service (IRS), the US tax authority, without demonstrated legal safeguards.
In France, the Finance Act for 2022 required the French Government to submit a report on the implementation of its information exchange commitments, in line with the GDPR and the recommendations of the EDPB. This report has never seen the light of day. The lack of political will to protect fundamental rights is clear.
At the same time, the IRS publicly asserts its right to collect data outside the United States, in total disregard of EU legislation.

1. Does the Commission consider it acceptable that this situation persists?
2. Does the Commission plan to launch infringement proceedings against the Member States that are failing to fulfil their obligations under EU law?
3. And, above all: is the Commission finally ready to guarantee that EU citizens’ data will be duly protected, even from non-EU powers?

Submitted: 14.5.2025

On behalf of the Commission the following answer was made public in July:

ENE-001950/2025Answer given by Mr McGrathon behalf of the European Commission(22.7.2025)

The independent authorities competent to monitor and enforce compliance with the General Data Protection Regulation (GDPR) are the data protection authorities (DPAs) in the Member States, under the control of national courts.

Referring to Article 96 of the GDPR, the European Data Protection Board (EDPB), which brings together all EU DPAs, has invited Member States to assess their existing international agreements and, where necessary, review them with the aim of bringing them in line with EU law [1]. The DPAs have agreed to assist the Member States in this exercise and the Commission understands that several of them are in discussions with the relevant ministries [2].

Several DPAs have also been dealing with requests concerning the data protection aspects of these international agreements. For instance, the Belgian DPA recently issued a decision [3] on the Belgian agreement implementing the Foreign Account Tax Compliance Act (FATCA), concluding that the transfer of personal data of ‘accidental Americans’ to the Internal Revenue Service was unlawful. The Belgian DPA ordered the relevant authority to bring the transfer of data in compliance within one year. Investigations in the same field are also ongoing in other Member States.

The Commission continues to closely follow further developments in this regard, including in collaboration with the EDPB. The Commission also continues to work with the authorities of the United States (US) including in the context of the bi-annual EU-US Regulatory Forum. In parallel, the Commission is in close contact with the Member States, for example in the Council working group on tax questions, where Member States are exchanging views about the implementation of their international agreements in this area, including data protection safeguards.

 

[1] See EDPB Statement 04/2021 of 13 April 2021, available at https://www.edpb.europa.eu/system/files/2021-04/edpb_statement042021_international_agreements_including_transfers_en.pdf.
[2] See also the letter from the EDPB of 7 July 2021, available at https://www.edpb.europa.eu/system/files/2021-07/edpb_letter_out2021-0119_intveld_igas.pdf.
[3] Issued on 24 April 2025, see https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-79-2025.pdf.

It shows that the Commission is taking a passive stance and is only willing to take action when there is serious criticism from the courts.